Code injection

2023-08-2117:15:00

PRIOn knowledge base

www.prio-n.com

code injection

draytek vigor2620

vigor2925

arbitrary code execution

vulnerability

shellcode

security advisory

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.9%

JSON

user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code.

CPENameOperatorVersion
vigor2620_firmwarelt3.9.8.4

CPE	Name	Operator	Version
	vigor2620_firmware	lt	3.9.8.4

References

draytek.com

gist.github.com/rrrrrrri/013c9eef64b265af4163478bfcf29ff4